Back to results
US 10,474,831 B1Granted
Large network attached storage encryption
AssigneeAmazon Technologies, Inc.
InventorsOleksandr Volkanov, Dean Giberson
Life of this patent
Estimating the term…
Abstract
Techniques for storing encrypted data using a storage service system are described herein. A computer system of a computation layer of the storage service system receives an encrypted key manifest, which is then decrypted using a cryptoprocessor of the computer system of the computation layer to produce a partition key. The partition key is then provided to a file system abstraction layer so that, as data is provided to the computation layer for storage, the file system abstraction layer can use the partition key to encrypt data and store the encrypted data in the storage layer.
Claims20
A computer-implemented method, comprising:
- delivering, to a customer of a computing resource service provider, a mobile storage service system, the mobile storage service system including a computation layer with a plurality of computation servers and a storage layer with a plurality of storage servers, each computation server of the plurality of computation server and each storage server of the plurality of storage servers being a computer system with one or more executable instructions;
- receiving, at the computation layer, an encrypted key manifest generated by a key management service of the computing resource service provider and encrypted using a first cryptographic key;
- decrypting the encrypted key manifest within a cryptoprocessor of a computation server of the computation layer to produce a partition key, the cryptoprocessor at least including a second cryptographic key corresponding to the first cryptographic key usable to decrypt the encrypted key manifest;
- providing, to a file system abstraction layer of the computation server, the partition key, the file system abstraction layer providing an interface to a storage layer of the mobile storage service system;
- receiving a set of data to store in the mobile storage service system;
- encrypting, using the computation server, the set of data to produce an encrypted set of data, the encrypting based at least in part on the partition key;
- storing the encrypted set of data in the storage layer using the file system abstraction layer;
- returning the mobile storage service system to a facility of the computing resource service provider;
- and
- transferring the set of data from the mobile storage service system to a datacenter of the computing resource service provider.
7 more elements
A system, comprising:
- a first set of computer systems with at least one computing device configured with processors and memory, the memory including instructions executable to cause the system to:
- receive an encrypted key manifest encrypted using a first cryptographic key;
- decrypt the encrypted key manifest using a cryptoprocessor to produce a partition key;
- provide the partition key to a file system abstraction layer, the file system abstraction layer providing an interface to a second set of computer systems with at least one computing device configured with processors and memory, the memory including instructions that, upon execution, cause the system to store encrypted data in the second set of computer systems;
- receive a set of data to store;
- encrypt the set of data to produce an encrypted set of data based at least in part on the partition key;
- and
- provide the encrypted set of data to the second set of computer systems using the file system abstraction layer.
5 more elements
A system, comprising:
- a set of computer systems with at least one computing device comprising one or more processors and memory, the memory including instructions executable to cause the system to:
- provision a storage service system by causing the system to at least:
- encrypt a key manifest to produce an encrypted key manifest using a first cryptographic key;
- and
- install a second cryptographic key associated with the first cryptographic key in a cryptoprocessor of each computation server of a plurality of computation servers of the storage service system;
- store data in a storage layer of the storage service system when the storage service system is located at a first location, the data encrypted based at least in part on a partition key, the partition key obtained by decrypting the encrypted key manifest in the cryptoprocessor using the second cryptographic key;
- and
- retrieve the data from the storage service system when the storage service system is located at a second location.
5 more elements
Dependencies are inferred from the claim text.